CVE-2022-45423 in DSS Professional
Summary
by MITRE • 12/27/2022
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2025
The vulnerability identified as CVE-2022-45423 affects various Dahua software products and represents a significant security weakness in the MQTT protocol implementation. This issue stems from improper authentication mechanisms within the MQTT credential handling system, allowing unauthorized parties to intercept and extract encrypted credentials through specially crafted network packets. The vulnerability specifically targets the MQTT interface where credentials are transmitted, creating a potential entry point for malicious actors seeking to compromise the system's security posture.
This technical flaw falls under the category of insufficient authentication and authorization controls, aligning with CWE-287 which addresses improper authentication issues. The vulnerability operates at the network level where MQTT protocol credentials are exposed without proper verification of the requesting entity's legitimacy. Attackers can exploit this weakness by sending carefully constructed packets to the vulnerable interface, which then responds with encrypted MQTT credentials. While the credentials themselves are encrypted, their exposure creates a significant risk as they represent a critical component of the system's authentication infrastructure.
The operational impact of this vulnerability extends beyond simple credential exposure, as it provides attackers with potential access to the MQTT communication channels used by Dahua devices for data transmission and system control. This weakness can be leveraged as a stepping stone for further attacks, potentially enabling lateral movement within networks where Dahua devices are deployed. The encrypted nature of the credentials does not prevent their collection, and once obtained, these credentials could be used to establish unauthorized connections to MQTT brokers, potentially allowing for data exfiltration, device manipulation, or disruption of services. The vulnerability affects organizations that rely on Dahua security products for surveillance and monitoring systems, creating risks for critical infrastructure deployments.
Mitigation strategies should focus on implementing proper authentication mechanisms for MQTT interfaces and ensuring that credential transmission occurs only over secure channels. Organizations should deploy network segmentation to isolate MQTT communication channels and implement monitoring solutions to detect unusual credential access patterns. The ATT&CK framework's T1071.004 technique for application layer protocol communication can be particularly relevant in identifying and blocking unauthorized MQTT credential access attempts. Regular security updates and patches from Dahua should be applied promptly, while network administrators should consider implementing additional authentication layers such as mutual TLS authentication to protect MQTT communications. The vulnerability highlights the importance of proper protocol implementation and the need for robust authentication controls in IoT and security device ecosystems.